Fee calculation uses full instead of net amount for pool impact

Impact: Medium

Likelihood: Medium

Link

In the _calcAddLiquidity function, there exists a discrepancy between the amount used for fee calculation(_amountIn) and the actual amount added to the pool(netAmount). The issue occurs in the following sequence:

// In _calcAddLiquidity:
valueChange = (_amountIn * tokenPrice).toDecimals(tokenDecimals + provDecimals, 18);
(, pFee) = _calcFeeRate(_token, _amountIn, valueChange, baseSetUp.addRemoveLiquidityFee, true);
netAmount = _amountIn - pFee;

The valueChange is calculated using the full _amountIn before any fees are deducted. This value is then used in _calcFeeRate to determine the pool's token ratio impact through the _calcDelta function. However, the actual amount being added to the pool is netAmount (which is _amountIn - pFee).

This creates a mismatch between:

1. The impact assessment used for fee calculation (based on the full amount).
2. The actual impact on the pool (based on net amount after fees).

For example, if a user adds 1000 Token with a 3% fee:

• The fee calculation assesses the pool impact using 1000 Token.
• But only 970 token is actually added to the pool.
• This leads to incorrect fee calculations as the actual pool impact is less than what was used to calculate the fee.

Charge Liquidity Provider with _amountIn+pFee.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.